nextcloud · mickenordin · Sep 30, 2023 · Oct 1, 2023 · Oct 3, 2023 · Oct 4, 2023
@@ -29,7 +29,7 @@ The rating depends on the installed text processing backend. See [the rating ove
 
 Learn more about the Nextcloud Ethical AI Rating [in our blog](https://nextcloud.com/blog/nextcloud-ethical-ai-rating/).
 	]]></description>
-	<version>3.5.0-alpha.2</version>
+	<version>3.5.0-alpha.3</version>
 	<licence>agpl</licence>
 	<author>Greta Doçi</author>
 	<author homepage="https://github.com/nextcloud/groupware">Nextcloud Groupware Team</author>

@@ -51,6 +51,10 @@
  * @method void setSmtpPort(int $smtpPort)
  * @method string getSmtpSslMode()
  * @method void setSmtpSslMode(string $smtpSslMode)
+ * @method bool|null getMasterPasswordEnabled()
+ * @method void setMasterPasswordEnabled(bool $masterPasswordEnabled)
+ * @method bool|null getMasterPassword()
+ * @method void setMasterPassword(string $masterPassword)
  * @method bool|null getSieveEnabled()
  * @method void setSieveEnabled(bool $sieveEnabled)
  * @method string|null getSieveHost()
@@ -81,6 +85,8 @@ class Provisioning extends Entity implements JsonSerializable {
 	protected $smtpHost;
 	protected $smtpPort;
 	protected $smtpSslMode;
+	protected $masterPasswordEnabled;
+	protected $masterPassword;
 	protected $sieveEnabled;
 	protected $sieveUser;
 	protected $sieveHost;
@@ -93,6 +99,8 @@ class Provisioning extends Entity implements JsonSerializable {
 	public function __construct() {
 		$this->addType('imapPort', 'integer');
 		$this->addType('smtpPort', 'integer');
+		$this->addType('masterPasswordEnabled', 'boolean');
+		$this->addType('masterPassword', 'string');
 		$this->addType('sieveEnabled', 'boolean');
 		$this->addType('sievePort', 'integer');
 		$this->addType('ldapAliasesProvisioning', 'boolean');
@@ -112,6 +120,8 @@ public function jsonSerialize() {
 			'smtpHost' => $this->getSmtpHost(),
 			'smtpPort' => $this->getSmtpPort(),
 			'smtpSslMode' => $this->getSmtpSslMode(),
+			'masterPasswordEnabled' => $this->getMasterPasswordEnabled(),
+			'masterPassword' => $this->getMasterPassword(),
 			'sieveEnabled' => $this->getSieveEnabled(),
 			'sieveUser' => $this->getSieveUser(),
 			'sieveHost' => $this->getSieveHost(),

@@ -125,6 +125,9 @@ public function validate(array $data): Provisioning {
 		$provisioning->setSmtpPort((int)$data['smtpPort']);
 		$provisioning->setSmtpSslMode($data['smtpSslMode']);
 
+		$provisioning->setMasterPasswordEnabled((bool)$data['masterPasswordEnabled']);
+		$provisioning->setMasterPassword($data['masterPassword'] ?? '');
+
 		$provisioning->setSieveEnabled((bool)$data['sieveEnabled']);
 		$provisioning->setSieveHost($data['sieveHost'] ?? '');
 		$provisioning->setSieveUser($data['sieveUser'] ?? '');

@@ -70,6 +70,7 @@ public function beforeController($controller, $methodName) {
 		try {
 			$this->provisioningManager->provisionSingleUser($configs, $user);
 			$password = $this->credentialStore->getLoginCredentials()->getPassword();
+
 			// FIXME: Need to check for an empty string here too?
 			// The password is empty (and not null) when using WebAuthn passwordless login.
 			// Maybe research other providers as well.
@@ -82,7 +83,8 @@ public function beforeController($controller, $methodName) {
 			}
 			$this->provisioningManager->updatePassword(
 				$user,
-				$password
+				$password,
+				$configs
 			);
 		} catch (CredentialsUnavailableException | PasswordUnavailableException $e) {
 			// Nothing to update

@@ -0,0 +1,58 @@
+<?php
+
+declare(strict_types=1);
+
+namespace OCA\Mail\Migration;
+
+use Closure;
+use OCP\DB\ISchemaWrapper;
+use OCP\DB\Types;
+use OCP\IConfig;
+use OCP\IDBConnection;
+use OCP\Migration\IOutput;
+use OCP\Migration\SimpleMigrationStep;
+use Psr\Log\LoggerInterface;
+
+class Version3500Date20231005091430 extends SimpleMigrationStep {
+	/** @var IConfig */
+	protected $config;
+
+	/** @var IDBConnection */
+	protected $connection;
+
+	/** @var LoggerInterface */
+	protected $logger;
+
+	public function __construct(IConfig $config, IDBConnection $connection, LoggerInterface $logger) {
+		$this->config = $config;
+		$this->connection = $connection;
+		$this->logger = $logger;
+	}
+
+	/**
+	 * @param IOutput $output
+	 * @param Closure $schemaClosure The `\Closure` returns a `ISchemaWrapper`
+	 * @param array $options
+	 * @return null|ISchemaWrapper
+	 */
+	public function changeSchema(IOutput $output, Closure $schemaClosure, array $options): ?ISchemaWrapper {
+		$schema = $schemaClosure();
+
+		$provisioningTable = $schema->getTable('mail_provisionings');
+		if (!$provisioningTable->hasColumn('master_password_enabled')) {
+			$provisioningTable->addColumn('master_password_enabled', Types::BOOLEAN, [
+				'notnull' => false,
+				'default' => false,
+			]);
+		}
+		if (!$provisioningTable->hasColumn('master_password')) {
+			$provisioningTable->addColumn('master_password', Types::STRING, [
+				'notnull' => false,
+				'length' => 256,
+			]);
+		}
+
+		return $schema;
+	}
+
+}
@@ -316,10 +316,18 @@ public function deprovision(Provisioning $provisioning): void {
 		}
 	}
 
-	public function updatePassword(IUser $user, string $password): void {
+	public function updatePassword(IUser $user, string $password, array $provisionings): void {
 		try {
 			$account = $this->mailAccountMapper->findProvisionedAccount($user);
 
+			$provisioning = $this->findMatchingConfig($provisionings, $user);
+			$masterPassword = $provisioning->getMasterPassword();
+			$masterPasswordEnabled = $provisioning->getMasterPasswordEnabled();
+			if ($masterPasswordEnabled && $masterPassword !== null) {
+				$password = $masterPassword;
+				$this->logger->debug('Password set to master password for ' . $user->getUID());
+			}
+
 			if (!empty($account->getInboundPassword())
 				&& $this->crypto->decrypt($account->getInboundPassword()) === $password
 				&& !empty($account->getOutboundPassword())

@@ -182,7 +182,8 @@ export default {
 		 * @return {boolean} True if the account should be disabled
 		 */
 		isDisabled(account) {
-			return this.passwordIsUnavailable && !!account.provisioningId
+
+			return (this.passwordIsUnavailable && !!account.provisioningId) && !!this.$store.getters.masterPasswordEnabled
 		},
 	},
 }

@@ -197,6 +197,37 @@
 						</div>
 					</div>
 				</div>
+				<div class="settings-group">
+					<div class="group-title">
+						{{ t('mail', 'Master password') }}
+					</div>
+					<div class="group-inputs">
+						<div>
+							<input
+								:id="'mail-master-password-enabled' + setting.id"
+								v-model="masterPasswordEnabled"
+								type="checkbox"
+								class="checkbox">
+							<label :for="'mail-master-password-enabled' + setting.id">
+								{{ t('mail', 'Use master password') }}
+							</label>
+						</div>
+						<div>
+							<input
+								:id="'mail-password-id' + setting.id"
+								v-model="passwordId"
+								type="hidden"
+								required>
+							<input
+								id="mail-master-password"
+								v-model="masterPassword"
+								:disabled="loading"
+								type="password"
+								required>
+							<label for="mail-master-password"> {{ t('mail', 'Master password') }} </label>
+						</div>
+					</div>
+				</div>
 				<div class="settings-group">
 					<div class="group-title">
 						{{ t('mail', 'Sieve') }}
@@ -411,6 +442,8 @@ export default {
 			smtpPort: this.setting.smtpPort || 587,
 			smtpUser: this.setting.smtpUser || '%USERID%domain.com',
 			smtpSslMode: this.setting.smtpSslMode || 'tls',
+			masterPasswordEnabled: this.setting.masterPasswordEnabled || '',
+			masterPassword: this.setting.masterPassword || '',
 			sieveEnabled: this.setting.sieveEnabled || '',
 			sieveHost: this.setting.sieveHost || '',
 			sievePort: this.setting.sievePort || '',
@@ -443,6 +476,8 @@ export default {
 				smtpHost: this.smtpHost,
 				smtpPort: this.smtpPort,
 				smtpSslMode: this.smtpSslMode,
+				masterPasswordEnabled: this.masterPasswordEnabled,
+				masterPassword: this.masterPassword,
 				sieveEnabled: this.sieveEnabled,
 				sieveUser: this.sieveUser,
 				sieveHost: this.sieveHost,
@@ -474,6 +509,8 @@ export default {
 					smtpHost: this.smtpHost,
 					smtpPort: this.smtpPort,
 					smtpSslMode: this.smtpSslMode,
+					masterPasswordEnabled: this.masterPasswordEnabled,
+					masterPassword: this.masterPassword,
 					sieveEnabled: this.sieveEnabled,
 					sieveUser: this.sieveUser,
 					sieveHost: this.sieveHost,

@@ -117,6 +117,7 @@ export const getters = {
 	isScheduledSendingDisabled: (state) => state.isScheduledSendingDisabled,
 	isSnoozeDisabled: (state) => state.isSnoozeDisabled,
 	googleOauthUrl: (state) => state.googleOauthUrl,
+	masterPasswordEnabled: (state) => state.masterPasswordEnabled,
 	microsoftOauthUrl: (state) => state.microsoftOauthUrl,
 	getActiveSieveScript: (state) => (accountId) => state.sieveScript[accountId],
 	getCurrentUserPrincipal: (state) => state.currentUserPrincipal,

@@ -103,6 +103,7 @@ export default new Store({
 				isSnoozeDisabled: false,
 				currentUserPrincipal: undefined,
 				googleOauthUrl: null,
+				masterPasswordEnabled: false,
 				sieveScript: {},
 				calendars: [],
 				smimeCertificates: [],

@@ -475,6 +475,9 @@ export default {
 	setGoogleOauthUrl(state, url) {
 		state.googleOauthUrl = url
 	},
+	setMasterPasswordEnabled(state, value) {
+		state.masterPasswordEnabled = value
+	},
 	setMicrosoftOauthUrl(state, url) {
 		state.microsoftOauthUrl = url
 	},

@@ -217,7 +217,8 @@ public function testBeforeController() {
 			->method('updatePassword')
 			->with(
 				$user,
-				'123456'
+				'123456',
+				$configs
 			);
 
 		$this->middleware->beforeController(